I found a Vulnerability. They found a Lawyer

The author, Yannick Dixken, a platform engineer and diving instructor, stumbled upon a glaring security flaw in a major diving insurer's member portal during a dive trip. This vulnerability allowed easy access to sensitive personal data, including that of minors, due to laughably simple mechanisms: incrementing numeric user IDs combined with a static default password that users were never forced to change. What began as a textbook responsible disclosure attempt quickly devolved into a legal standoff, underscoring significant issues in corporate security and researcher relations.

• The core vulnerability involved sequential user IDs and a static default password across accounts, which facilitated unauthorized access to full user profiles, including names, addresses, phone numbers, and dates of birth, some belonging to children as young as 14.
• The author confirmed the flaw with a rudimentary Selenium script, highlighting that no advanced exploits were needed to compromise numerous accounts.
• Following established protocols, Dixken reported the issue to CSIRT Malta and the organization directly, offering a standard 30-day embargo for remediation.
• Instead of engaging their IT team, the organization's lawyers responded, accusing Dixken of potential criminal offenses under Maltese law and demanding he sign a broad non-disclosure agreement.
• The company disingenuously attempted to shift blame to users for not changing passwords, despite their own failure to implement basic security measures as mandated by GDPR, particularly Article 5(1)(f) and Article 24(1).
• Although the vulnerability was eventually fixed, Dixken received no confirmation that affected users were notified, potentially violating GDPR Article 34(1) concerning data breach communications to individuals.

This entire episode vividly illustrates the "chilling effect" within the security research community, where organizations often prioritize reputation management and legal intimidation over genuine data protection and fostering collaboration with ethical hackers. The author stresses that an organization's response to a vulnerability reveals more about its security culture than the vulnerability itself.